1850edc333a3dd2bf6677e37027976c29d1d4d12f98ab53298a0f3bef7ed272c

Analysis

max time kernel
144s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.9MB
Sample260712-rwallsdx3z
SHA256 1850edc333a3dd2bf6677e37027976c29d1d4d12f98ab53298a0f3bef7ed272c
MD5 05cace867d52bbccb4c5eff800bc1ea2
SHA1 4a4d669948886f531e8b1c46782f8262e1d226fb
SHA512 845250431c6a8f75b06d4269ed2170ed1bb4048f0273e96332f2647f2aad8fe87138eed595904800315eb0d035474bda9895bed8db48e89e1f0238052c17b38c
SSDEEP 49152:1i0BpWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqt3F/el4q:ctO8qRFTauXc5
TLSH
T18B167C46E6B940E5C0BBD13D8A979647FAB1385AC73197CB46A1871A1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
6028	alg.exe
4208	elevation_service.exe
2812	elevation_service.exe
1268	maintenanceservice.exe
5872	OSE.EXE
3512	GameInputSvc.exe
4376	GameInputSvc.exe
4928	msdtc.exe
5352	PerceptionSimulationService.exe
5412	perfhost.exe
2972	ReFsDedupSvc.exe
5912	locator.exe
3248	SensorDataService.exe
4420	snmptrap.exe
1516	ssh-agent.exe
3412	TieringEngineService.exe
1552	AgentService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5fc30963e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-wal	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	GameInputSvc.exe
4376	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4080	2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	6028	alg.exe
Token: SeDebugPrivilege	6028	alg.exe
Token: SeTakeOwnershipPrivilege	4208	elevation_service.exe
Token: SeTcbPrivilege	3512	GameInputSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3412	TieringEngineService.exe
Token: SeManageVolumePrivilege	3412	TieringEngineService.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4376	3512	GameInputSvc.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_05cace867d52bbccb4c5eff800bc1ea2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3248

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:1552

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2d1931a360d4f456f967d894bd4738a19b049f9ed665514cd63fc1ba033baf14
MD5 e71620bdd00f925d1e49cbdc78cdae55
SHA1 6a62105c2962b414b45c8fc7b6718d1ed32a2abb
SHA512 a5332f0b257663f2c5c4a58466108b0f54891fc7f7b49db1ad7ddcbad69eca43c63565b8e45b21a6dd33645b700d68a6256c9e5e693c0c009cbf2a892953405b
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnP3F/el4q:53q6gjBN5
TLSH
T147D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 33026fb07e4bade27d25bc3d26c75c8b38735dfe146bd967fda810780f68e950
MD5 d28c953fb0449274b47a412ea8a06aee
SHA1 020dbebc808f3222bcaa0f350c28c7ee915abe8f
SHA512 bd3186ab54cb085ea1a5b2ac0b725896fe909fcc0e6f896928cfb37b5d928e07d4c735690f158bd9a2ac75d0b1e412686a3ad4a00e2a4b18485b3d2391f9bc39
SSDEEP 12288:T1XLsRre0x8VP5m2czAfZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNln8:JXY9XcczAwW5hXSHg/ehHeRqh9zS
TLSH
T18D05022463E048F9ED67927DCDA28905E672785147A4E78F03F4992A0F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 df5aa23aa7e896ff80fe32b75f842540132d706eaec0c168dc7066143abbf8ac
MD5 cae7401ef8f6eb267c5315c966e4a6c9
SHA1 3b4de8aec0d2c5eefdb29d56c2521f8ba795e72c
SHA512 2f2491df9a16e69e788293faeaa0599de8c5c9e06e2f5c28f89c59f5e07cb6e6eb51454b04558108ff81602c3e8a53cba1c1eb9031c9330bdebc930154c640a7
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CdZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:QwuuOWPW5hXSHg/ehHeRqh9zS
TLSH
T16C05F18573E44CF9E56296398697C536F7F2B8022A25DB1F0360C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 55dc7b491f08b8201672e1a45c461bcbe344a9e3a59463ab8b75c1f22c14eba1
MD5 6b6c6b3920540065caa8fcb1e8e6820e
SHA1 b04365322a2501c73a81b3baa21f720b373255bd
SHA512 90e3c5d3f8cb70ef183d586f9762ffc02b953bc40684c74df85a962d1bcd239197baedd438ae8101e48ff79551f586d69d704b5d4961cf6c15c6f698e0253cd3
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glj3F/el4q:Mu6JmTxd2dc5
TLSH
T1F6D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 74341979fdb1fabca5905d101124d063a51da002c66c101221a68868bc626022
MD5 5932ebb82329e58c8d720c3ceb5fb557
SHA1 25ba766936ce0161aa676bb86045c472188d73f9
SHA512 333ac5d5fbecea0f442caa71fc57dd9ab36ae8881a67469deee994d95d8bb879dc07f4772db06406e074a87388d788871a06ea5f3d5182ed9221f84a95d67a17
SSDEEP 12288:Rg71Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:6uW5hXSHg/ehHeRqh9zS
TLSH
T1ACD423C08398CC16F260BEF146B78F14B11C74512FAEA9CF532EA45A0AB35C7BE9556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6b98e513881f9f9a3efaf61e5bdd75ae1fca44918233f8005d284552ac60a40d
MD5 f90e3ba9a5e19cd7ad648c6406e78c75
SHA1 8da28ee058aab58ca3614a88957f88b9f96cb51a
SHA512 3213f5d224c3738ec61207e6f0cb567c3a57d1d00441725aa7195cd8726b15f0ae69bb15881621f4f3f101f7f85f531c35db649e6ec29e4b4127a79f7962befd
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYOzIe1SgNOLUpHzljo5YAJkY/z15VXj9:Egb4mBIBhGFzjsg8LmNoKAJkY5/X
TLSH
T17565AE1E22EC01F5E0FAE2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 672a03c55f306224b175d745c043b77d3f27375d07f6c84a0b90b3b3abad7daa
MD5 3a9b0f68e9f63c97b87f2f62a18e41e9
SHA1 65c4b0015306866b37cd59f325c015d8357e1bb0
SHA512 1f60bb5d07f8598d174d6c02f70a5dcc22cc15af60444b9f9d2a17669361e2d1f4130c578dcf825e51b298945ce8874377428b9c34a4a545f6d0791b9ca5ba04
SSDEEP 12288:XBGyzZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xGyEW5hXSHg/ehHeRqh9zS
TLSH
T17BE4239462E5D454D131FBB58AB34E56B4B430502F2D2AEF02E9E43A4F725C3B739C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 91c289c358fcb35000362933aeeda42bf506d1bc9525ea007b1c490638a9d80f
MD5 c0bba2ee2ca1ec7a88dc52444ee93a96
SHA1 7feecc70938492631d32f9ba16d1721db91cc236
SHA512 c67ea0c364aa8e35d4f1fe5c0ac12f46272e58e17c5841103e88fbcefd0e475102db86c3abe10167158fcaf4272e3cd64665b56dd98a76bb66a8f199565b11da
SSDEEP 12288:TqZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:TDW5hXSHg/ehHeRqh9zS
TLSH
T1DED423C05395CC16E250BEF54BB34F05B54874412FAE2ACF136EB41A4BB74C7BA794A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 cda56c48ab1991ae8d09fa90943d9bc5cb09c564a636938f65c6d2f2d5f836e4
MD5 0292b9a3fac23dd334a7bc0da82ff7e4
SHA1 dca2be622ca354161690920f7dc78437b125950b
SHA512 d52b4eb465b6f872b7cf98379ce9f1902c866ea69b8cfdc42bec966421eb892f3d1658b754a259ac9c811a4019d094f3b4156547fb5d80e652cbfe66902e9a2e
SSDEEP 24576:dMV8i8tVJqH1Mzria7/m+zIe1SgNOLUpHzljo5YAJkY/z15VXj9:2qFtLqVra7/rjsg8LmNoKAJkY5/X
TLSH
T13935F16673E501F0E47BE03889464667F6B2B4251364EBDF0BA88B551F23BD10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 43841d561e91c6070b00bf44e0e16aa469358a854ef0c13393655e84a73ea092
MD5 166f7b1566796ad7cad7332ef8b22214
SHA1 29eb472dd0b246d2e32d6d2b7140466237f3813b
SHA512 7579988af9cafe80737ca418b448a1a5999ccca90e8cc49059e8fcd9171e13df63a94bd95f394e543e5c90d586d7b639d0778f412739375a4b3aeec8f333d661
SSDEEP 12288:gHvUrBFrEjwaQvZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQgW5hXSHg/ehHeRqh9zS
TLSH
T19305F15E22E81CE5E676F17D8A828709F77174621712A2CF02E1817E4F639D9BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 4e8aca9cb948d75755dd0ff033595217923abc589ddbe819d7d5dc19064f9c56
MD5 cd80158d01b823ce047ae4ba3801e4fd
SHA1 51f16b0676cbcac4f12b439356efdb28c11aa9f6
SHA512 fafda1c8e096e1b5ffc37a297ed420db3bf9fdd8f3c7e835af18c9192eec29d383348cc7d35e08e8fb93c30845bc31d1e8bddfc5058793537e49891db8bbe4cf
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjM3F/el4q:5G05lO43bQ5
TLSH
T1F5D5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fdbc9dab616db867c6c6b06f41643243a80ecd117952a5a19d511f0076d8e80e
MD5 cfdf18cb155b995857b55549e687d258
SHA1 2f3e35c6b094584753d9d8ec4b1d84f0adb04050
SHA512 ddcb9db9b6abc3eb64d6195ff3d8e9e467ecc335d8b741804547c6d49b247b384078328ec6b273c8e02a9cd4278edcbb9e2d6ede2f44a38ca38a3692fa844fd0
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkRiW5hXSHg/ehHeRqh9zS:INc/zEOVHFY3F/el4q
TLSH
T1E1858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 80ed76c620d7dffe6eeb8faab0680ef6b3138c49142e14b7872c6346c4e9de9a
MD5 70784563b01ab911144680df990da81f
SHA1 d6467d4eac7f16ad6bc2258dda53727f65db57ba
SHA512 535d1b3b11d72230c2f5481596055ecce934a791b83e15f4ee6d09f2547d87b4cc1db080b41a44df9eba0279b0fa3739b4e11bab31304eb6bec6e39454dec9f2
SSDEEP 24576:XJnJPbzB4SUOzIe1SgNOLUpHzljo5YAJkY/z15VXj9:XJnJv6SUOjsg8LmNoKAJkY5/X
TLSH
T1AC15D03DD2A810E8E4B7C2B4811A169AFE31387C2F2169C759B4D5353F12FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b1df47dd26b15a04283f37fb4b89a6e1236af60994bd3c67ff1ca54b37f6226a
MD5 b3df0c30332613629bcf58e6a2131c72
SHA1 90e35b68143d11d3c971a5e5429caad4df347e55
SHA512 412a12f9fc080cc23b9583f79e33cf2741a1948ac5c6566385a53167de9012e987058cf77dfccc3eaa988a8f036f5fa2f775bf3be3b219f560bd63591414539a
SSDEEP 49152:VCLHGeeV5ijCmlDWDkEjsg8LmNoKAJkY5/X:Ma+LmNoKmt1
TLSH
T1E6A56B05A7EB5184F8F3CAF5CA2694168A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 1cbe7610b56f0cc06022b7f89b9ea2b2041a701e87d5fc6e5c73c7b53241cf06
MD5 5fdd2394a6e61b8c209bf294e639bf34
SHA1 cad9cc3b550fd06aa50902129d0f60b763f104d0
SHA512 a9bfa7453529977f775dc3d1e6855596a4bb1432019b719ee63964b0cc5df356dab4b491a30f1f1c5225f08c9551416c31297a7739cf041db586bfe5d2f23a37
SSDEEP 12288:XxHEk/j5ZI7QZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DIVW5hXSHg/ehHeRqh9zS
TLSH
T14905015C637A40F5D167E07E86930602E2B1B0719B665ADF07A8C47E4FA3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 c652635cecf12f6cd7ddacd969fe62e00c7ca4874e3317202b34c6434c4a657b
MD5 6bae9e40ea402c7ed6b0087f50df0423
SHA1 ec70376e876baf9a15150ec01f1abcb656c99156
SHA512 9a94edbe17c4512e54db9a473e0393f1c99c013bfa8ae11dbe71ccd53714ed4436beb15fbb24ff42965c877d214159276a41b44e9eff3f27a82a04e523efc257
SSDEEP 12288:NG6ky8Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tyFW5hXSHg/ehHeRqh9zS
TLSH
T18EF412405394D495F2716AB88BB38694EA38BC206F6667DF12A5E53E1F337C2BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 4edb883abd528eaaf4fbd32aa51193d7c4b028fe6afd9c403eb88a422dacf6e9
MD5 fc1a5b9a738f127caad5f39fb31c1c91
SHA1 669867bc0249614b1af93cfcb34c424e15454c8b
SHA512 4728b22f7543226b4a006e08818aeb395860c747158952e84974401abecf7eb84400b720fe91958e0267361c8b08f97c63b323bfa51ff85350274b885b1a34f4
SSDEEP 12288:WUnrzIoXt7zSgNOLgqMpHzXV6xvCo5Ys1JrIaF/KIWcZjqFsPVXj3XqMQY9:JrzIe1SgNOLUpHzljo5YAJkY/z15VXj9
TLSH
T16BD4239A633DACD8F01A3C71451A029E047275783B2025EBDDF0BA76D6793C24EB9D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 62faaed2d0e6507b7532a3a002a30478c55c15f130644782c9059e41d48d5a79
MD5 4829a556e0f65170f3be5fe73ef53f35
SHA1 ddaa730b3e6fb3ea63a07d2f1ee7c95f63a04cac
SHA512 36260fc003b41b1c1bdf7303b8af73fac700640eab78f681fcf58eda0c6d455bed28b525d2c4120002e1cfb3de1d9d3dd4fa81d2e78143e967fd05dbd73d7ff4
SSDEEP 24576:wpgmLoTfaidZW5zIe1SgNOLUpHzljo5YAJkY/z15VXj9:8gVTrZW5jsg8LmNoKAJkY5/X
TLSH
T1CE559C1DB3EA09CAE2B2D675D8621493D633B4311772D6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0ffb3030f4efc1d2bf6f72887473079cfff18cb9a9a049c022f87159c0a02361
MD5 b3a2a06b00c6e40709bd089799bccb86
SHA1 3111eb7cecfa5d42fc5bb7af90fceaceebf45297
SHA512 14d106a6073888e682483409dc281eda32e65aea9a612f2ccc024324c6c4ebe98a49cb8278ca74cde823b6ef86c9544abda67c1c1f82661559eb3bd2240e64de
SSDEEP 49152:TDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Kjsg8LmNoKAJkY5/X:I3Upow8sBJ+LmNoKmt1
TLSH
T177A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-48-0x0000021C70DA0000-0x0000021C70E06000-memory.dmp

Download

memory/1268-46-0x00007FF7D13B0000-0x00007FF7D1518000-memory.dmp

Download

memory/1268-53-0x0000021C70DA0000-0x0000021C70E06000-memory.dmp

Download

memory/1268-55-0x00007FF7D13B0000-0x00007FF7D1518000-memory.dmp

Download

memory/1268-47-0x0000021C70DA0000-0x0000021C70E06000-memory.dmp

Download

memory/1516-324-0x0000028023920000-0x0000028023986000-memory.dmp

Download

memory/1516-322-0x00007FF7E05C0000-0x00007FF7E0863000-memory.dmp

Download

memory/1516-323-0x0000028023920000-0x0000028023986000-memory.dmp

Download

memory/1552-342-0x0000021B373C0000-0x0000021B37426000-memory.dmp

Download

memory/1552-346-0x0000021B373C0000-0x0000021B37426000-memory.dmp

Download

memory/1552-348-0x00007FF7712D0000-0x00007FF7715F1000-memory.dmp

Download

memory/1552-340-0x00007FF7712D0000-0x00007FF7715F1000-memory.dmp

Download

memory/1552-341-0x0000021B373C0000-0x0000021B37426000-memory.dmp

Download

memory/1920-352-0x00007FF66C450000-0x00007FF66C6DB000-memory.dmp

Download

memory/1920-353-0x0000021693900000-0x0000021693966000-memory.dmp

Download

memory/1920-354-0x0000021693900000-0x0000021693966000-memory.dmp

Download

memory/2812-38-0x0000021664750000-0x0000021664898000-memory.dmp

Download

memory/2812-40-0x00000216649C0000-0x0000021664A26000-memory.dmp

Download

memory/2812-39-0x00000216649C0000-0x0000021664A26000-memory.dmp

Download

memory/2972-285-0x00007FF6603C0000-0x00007FF660B04000-memory.dmp

Download

memory/2972-286-0x000002C63FFF0000-0x000002C640056000-memory.dmp

Download

memory/2972-287-0x000002C63FFF0000-0x000002C640056000-memory.dmp

Download

memory/2972-361-0x00007FF6603C0000-0x00007FF660B04000-memory.dmp

Download

memory/3248-303-0x0000020E28FC0000-0x0000020E29026000-memory.dmp

Download

memory/3248-304-0x0000020E28FC0000-0x0000020E29026000-memory.dmp

Download

memory/3248-302-0x00007FF7AD5A0000-0x00007FF7AD9B7000-memory.dmp

Download

memory/3248-377-0x00007FF7AD5A0000-0x00007FF7AD9B7000-memory.dmp

Download

memory/3412-331-0x00007FF6D4A00000-0x00007FF6D4B95000-memory.dmp

Download

memory/3412-332-0x00000225C03A0000-0x00000225C0406000-memory.dmp

Download

memory/3412-333-0x00000225C03A0000-0x00000225C0406000-memory.dmp

Download

memory/3512-311-0x00007FF7DCC00000-0x00007FF7DCCC9000-memory.dmp

Download

memory/3512-236-0x00000163FC9B0000-0x00000163FCA16000-memory.dmp

Download

memory/3512-237-0x00000163FC9B0000-0x00000163FCA16000-memory.dmp

Download

memory/3512-235-0x00007FF7DCC00000-0x00007FF7DCCC9000-memory.dmp

Download

memory/4080-3-0x00007FF7864D0000-0x00007FF786F95000-memory.dmp

Download

memory/4080-23-0x000001E1DF430000-0x000001E1DF496000-memory.dmp

Download

memory/4080-1-0x000001E1DF430000-0x000001E1DF496000-memory.dmp

Download

memory/4080-26-0x00007FF7864D0000-0x00007FF786F95000-memory.dmp

Download

memory/4080-0-0x000001E1DF430000-0x000001E1DF496000-memory.dmp

Download

memory/4208-29-0x000001DD05380000-0x000001DD054C8000-memory.dmp

Download

memory/4208-31-0x000001DD054D0000-0x000001DD05536000-memory.dmp

Download

memory/4208-32-0x000001DD054D0000-0x000001DD05536000-memory.dmp

Download

memory/4208-30-0x000001DD054D0000-0x000001DD05536000-memory.dmp

Download

memory/4256-371-0x00007FF765020000-0x00007FF765527000-memory.dmp

Download

memory/4256-372-0x000001989B300000-0x000001989B366000-memory.dmp

Download

memory/4256-373-0x000001989B300000-0x000001989B366000-memory.dmp

Download

memory/4376-248-0x0000014C48E70000-0x0000014C48ED6000-memory.dmp

Download

memory/4376-244-0x00007FF7DCC00000-0x00007FF7DCCC9000-memory.dmp

Download

memory/4376-321-0x00007FF7DCC00000-0x00007FF7DCCC9000-memory.dmp

Download

memory/4376-246-0x0000014C48E70000-0x0000014C48ED6000-memory.dmp

Download

memory/4420-312-0x00007FF7B5AE0000-0x00007FF7B5B94000-memory.dmp

Download

memory/4420-314-0x00000229C16C0000-0x00000229C1726000-memory.dmp

Download

memory/4420-378-0x00007FF7B5AE0000-0x00007FF7B5B94000-memory.dmp

Download

memory/4420-313-0x00000229C16C0000-0x00000229C1726000-memory.dmp

Download

memory/4928-249-0x00007FF616B10000-0x00007FF616C2A000-memory.dmp

Download

memory/4928-330-0x00007FF616B10000-0x00007FF616C2A000-memory.dmp

Download

memory/4928-253-0x000001CE44B60000-0x000001CE44BC6000-memory.dmp

Download

memory/4928-254-0x000001CE44B60000-0x000001CE44BC6000-memory.dmp

Download

memory/5352-339-0x00007FF7155F0000-0x00007FF71573A000-memory.dmp

Download

memory/5352-267-0x0000020E1DFC0000-0x0000020E1E026000-memory.dmp

Download

memory/5352-264-0x00007FF7155F0000-0x00007FF71573A000-memory.dmp

Download

memory/5352-266-0x0000020E1DFC0000-0x0000020E1E026000-memory.dmp

Download

memory/5412-274-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5412-279-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5412-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5412-351-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5436-364-0x00007FF663BB0000-0x00007FF664081000-memory.dmp

Download

memory/5436-363-0x000001E1F2500000-0x000001E1F2566000-memory.dmp

Download

memory/5436-362-0x000001E1F2500000-0x000001E1F2566000-memory.dmp

Download

memory/5872-59-0x00000280855D0000-0x0000028085636000-memory.dmp

Download

memory/5872-60-0x00000280855D0000-0x0000028085636000-memory.dmp

Download

memory/5872-58-0x0000028085320000-0x0000028085468000-memory.dmp

Download

memory/5912-294-0x000001A50B9F0000-0x000001A50BA56000-memory.dmp

Download

memory/5912-368-0x00007FF7C7770000-0x00007FF7C781E000-memory.dmp

Download

memory/5912-293-0x00007FF7C7770000-0x00007FF7C781E000-memory.dmp

Download

memory/5912-295-0x000001A50B9F0000-0x000001A50BA56000-memory.dmp

Download

memory/6028-10-0x00007FF6B5280000-0x00007FF6B53A3000-memory.dmp

Download

memory/6028-16-0x0000026DB2760000-0x0000026DB27C6000-memory.dmp

Download

memory/6028-64-0x00007FF6B5280000-0x00007FF6B53A3000-memory.dmp

Download

memory/6028-11-0x0000026DB2760000-0x0000026DB27C6000-memory.dmp

Download

memory/6028-12-0x0000026DB2760000-0x0000026DB27C6000-memory.dmp

Download